Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Rekor may crash when given bad intoto entries

CVE-2023-33199 · published 3 years ago
Summary

Rekor, the tamper‑resistant ledger used in software supply chains, can stop processing a request if it receives a malformed intoto/v0.0.2 entry, causing the service to return a 500 error. The problem does not take the whole service down, but it can affect users trying to submit data. Upgrade Rekor to version 1.2.0 or later to prevent this issue; there are no other fixes available.

What to do
  • Update github.com sigstore to version 1.2.0.
  • Update linuxfoundation rekor to version 1.2.0 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com sigstore < 1.2.0
Fix: upgrade to 1.2.0
– linuxfoundation rekor < 1.2.0
cpe:2.3:a:linuxfoundation:rekor:*:*:*:*:*:*:*:*
Original advisory text
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-617Reachable Assertion
Timeline
Published26 May 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-frqx-jfcm-6jjr · GHSA
CVE-2023-33199 · NVD
CVE-2023-33199 · OSV
Track software like this
Free during beta